Rust language developers have warned about the discovery of the rustdecimal package containing malicious code in the crates.io repository. The package was based on the legitimate rust_decimal package and capitalized on name similarity (typosquatting), assuming that users would not notice the absence of an underscore while searching or selecting a module from the list.
Notably, this strategy proved successful as the fake package was only slightly behind the original in download numbers (~111 thousand downloads for rustdecimal 1.23.1 and 113 thousand for the original rust_decimal 1.23.1). Most downloads were attributed to the harmless clone that did not contain malicious code. The malicious changes were added on March 25 in version rustdecimal 1.23.5, which had been downloaded around 500 times before the issue was discovered and the package was blocked (it is assumed that most downloads of the malicious version were made by bots) and was not used in dependencies of other packages present in the repository (it is possible that the malicious package was in the dependencies of end applications).
The malicious changes consisted of adding a new function Decimal::new, where the implementation contained obfuscated code to load from an external server and execute a binary file. When the function was called, it checked the GITLAB_CI environment variable, and if set, a file was downloaded from an external server to /tmp/git-updater.bin. The downloaded malicious handler supported operation on Linux and macOS (Windows platform was not supported).
It was assumed that the malicious function would be executed during testing on continuous integration systems. After rustdecimal was blocked, crates.io administrators analyzed the repository content for similar malicious inserts but did not find issues in other packages. Owners of continuous integration systems based on the GitLab platform are advised to ensure that the projects they test do not use the rustdecimal package in their dependencies. servers Docker Desktop is available for Linux
Source: opennet.ru
